Commit — Supply Chain Risk Scoring

Name: Commit — Supply Chain Risk Scoring
Author: piiiico

MCP serverMCP

Supply chain risk scoring for npm, PyPI, Cargo, and Go. 9 tools. Behavioral signals.

by piiiicorepository ↗homepage ↗v1.36.0MIT

Is this yours?

This record is unclaimed

Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.

Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"proof-of-commitment","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.

Claim this record

Observed by Wellknown

Evidence

Everything here was measured by our prober or read from a registry. Nothing is self-reported.

30-day availability111/111 checks ok

when	check	result	http	latency	detail
2 h ago	mcp initialize	ok	200	48 ms	server proof-of-commitment 1.14.0 · protocol 2025-06-18 · 12 tools
8 h ago	mcp initialize	ok	200	117 ms	server proof-of-commitment 1.14.0 · protocol 2025-06-18 · 12 tools
15 h ago	mcp initialize	ok	200	64 ms	server proof-of-commitment 1.14.0 · protocol 2025-06-18 · 12 tools
21 h ago	mcp initialize	ok	200	81 ms	server proof-of-commitment 1.14.0 · protocol 2025-06-18 · 12 tools
27 h ago	mcp initialize	ok	200	45 ms	server proof-of-commitment 1.14.0 · protocol 2025-06-18 · 12 tools
34 h ago	mcp initialize	ok	200	124 ms	server proof-of-commitment 1.14.0 · protocol 2025-06-18 · 12 tools
2 d ago	mcp initialize	ok	200	148 ms	server proof-of-commitment 1.14.0 · protocol 2025-06-18 · 12 tools
2 d ago	mcp initialize	ok	200	49 ms	server proof-of-commitment 1.14.0 · protocol 2025-06-18 · 12 tools
2 d ago	mcp initialize	ok	200	124 ms	server proof-of-commitment 1.14.0 · protocol 2025-06-18 · 12 tools
3 d ago	mcp initialize	ok	200	103 ms	server proof-of-commitment 1.14.0 · protocol 2025-06-18 · 12 tools

Tools observed via MCP handshake

query_commitment — Query verified behavioral commitment data for a domain. Returns aggregated signals: unique verified visitors, repeat visit rate, and average time spent. These p
lookup_business — Search for a Norwegian business and get its commitment profile from public data (Brønnøysund Register Centre). Returns real commitment signals: longevity, finan
lookup_business_by_org — Look up a specific Norwegian business by organization number (9 digits) and get its commitment profile. Returns temporal, financial, and operational commitment
lookup_github_repo — Get a behavioral commitment profile for any public GitHub repository. Returns real signals that prove genuine investment: how long the project has existed, rece
lookup_npm_package — Get a behavioral commitment profile for any npm package. Returns real signals that prove genuine investment: package age, download volume and trend (growing/sta
lookup_pypi_package — Get a behavioral commitment profile for any PyPI (Python) package. Returns real signals: package age, download volume and trend, release consistency, publisher/
lookup_cargo_crate — Get a behavioral commitment profile for any Rust crate on crates.io. Returns real signals: crate age, download volume (estimated weekly from 90-day totals), ver
lookup_go_module — Get a behavioral commitment profile for any Go module on proxy.golang.org. Takes a full module path (e.g., "github.com/gin-gonic/gin", "golang.org/x/net", "k8s.
audit_dependencies — Batch-score multiple npm, PyPI, Cargo, or Go packages for supply chain risk. Takes a list of package names and returns a risk table sorted by commitment score (
audit_github_repo — Audit the supply chain risk of a GitHub repository's dependencies. Fetches the repo's package.json and/or requirements.txt from GitHub and runs behavioral commi
audit_dependency_tree — Map the full dependency tree of an npm package and identify CRITICAL supply chain risks at every level. Unlike auditing a flat list of packages, this tool trav
get_api_key — Create a free Commit API key instantly — no browser required. When you've hit the daily free query limit (or just want faster access), call this tool with your

Declared by sources

What the publisher says

Attributed to the source that supplied each field. Treated as claims, not facts.

No long description beyond the summary.

supply-chainsupply-chain-securitysecurityscannernpmpypicargorustgolanggogo-modulesdependenciesauditriskbehavioralcommitmentmaintainerpublisherprovenancetrusted-publishingmcpmcp-servervulnerabilityscadependency-auditlockfiledevsecopscisarifcode-scanning

kind Official MCP Registry

name Official MCP Registry

license npm registry

repoUrl Official MCP Registry

summary Official MCP Registry

version Official MCP Registry

description Official MCP Registry

homepageUrl Official MCP Registry

publisherName Official MCP Registry

Provenance

Where this record came from

Every source is kept verbatim. Field changes are logged as events.

Official MCP Registryio.github.piiiico/proof-of-commitment

first seen 2 mo ago · fetched 10 h agoopen ↗

npm registryproof-of-commitment

first seen 2 mo ago · fetched 11 h agoopen ↗

Field history (12 recent events)

2 mo ago · declared · name → "Commit — Supply Chain Risk Scoring"
2 mo ago · declared · summary → "Supply chain risk scoring for npm, PyPI, Cargo, and Go. 9 tools. Behavioral signals."
2 mo ago · declared · description → "Supply chain risk scoring for npm, PyPI, Cargo, and Go. 9 tools. Behavioral signals."
2 mo ago · declared · homepageUrl → "https://getcommit.dev"
2 mo ago · declared · repoUrl → "https://github.com/piiiico/proof-of-commitment"
2 mo ago · declared · repoUrl → null
2 mo ago · declared · license → "MIT"
2 mo ago · declared · summary → "Supply chain security risk scorer for npm, PyPI, Cargo, and Go packages — behavioral signals that can't be faked"
2 mo ago · observed · packageFacts → {"name":"proof-of-commitment","registry":"npm","publishedAt":"2026-06-20T16:32:52.702Z","latestVersion":"1.36.0","weekly
2 mo ago · declared · protocols → ["mcp"]
2 mo ago · declared · description → "Supply chain security risk scorer for npm, PyPI, Cargo, and Go packages — behavioral signals that can't be faked"
2 mo ago · declared · publisherName → "piiiico"

This record is unclaimed

Evidence

What the publisher says

Capabilities

Where this record came from